Tribot alternative auth server (unofficial, with VIP)

[yumxuidu]

If you're ever in a situation where Tribot is down, there is an alternative authentication server set up that anyone can use.

Keep in mind that you can't get any scripts off it or anything like that.
https://github.com/ss23/tribot-authentication/wiki/Install-For-Users
Also, a bit technical, so if you're uncomfortable setting it up, or otherwise need support, probably better just to leave it.
Nonetheless, it's an option for those who want a quick way to get it working when it's down officially.

 

[YoHoJo]

If you use this, you'll probably get hacked. I take no responbility for you doing it. You'll also get banned from Tribot officially if you use this. And from Runescape. Basically, don't use this.

Wut.
Why would anyone use this with an intro like that?
Also I'm pretty sure over 80% of the people will have no clue how to set this up .

 

"If you use this, you'll probably get hacked. I take no responbility for you doing it. You'll also get banned from Tribot officially if you use this. And from Runescape. Basically, don't use this."

Is it really worth it ?

 

[yumxuidu]

Wut.
Why would anyone use this with an intro like that?
Also I'm pretty sure over 80% of the people will have no clue how to set this up .

Oh, but you underestimate the kind of people who are unwilling to spend $5 a month!

Of course, the disclaimer is because I'm not going to be responsible when some idiot decides that using this gets him hacked. The code is clean, etc.

 

[yumxuidu]

"If you use this, you'll probably get hacked. I take no responbility for you doing it. You'll also get banned from Tribot officially if you use this. And from Runescape. Basically, don't use this."

Is it really worth it ?

If you're not a VIP on Tribot already, probably. For the more technical people, they can probably figure out that the chances of a ban are closer to 0, and even if they got a ban from Tribot, why would it matter if they're not paying.

Anyway, I'm offering it as a possible option, not as a replacement. People like being able to bot when the servers are down. This set of code lets them do that very easily. Options options.

 

[Bugabuse]

Wut.
Also I'm pretty sure over 80% of the people will have no clue how to set this up .

Lol read that and though meehh...

Watched the video and its just editing the hosts file... People should be able to handle that :L

Thanks for the option OP - Will be useful soon when powerbot releases its 07 bot and shuts down tribot once more

 

[Bugabuse]

Bump this thread as tribot's down atm - Thanks op <3

 

[Kangaroo]

Does anybody know how he managed to get the files from Tribot.org? The site does have a few vulnerabilities, so I'm guessing OP managed to get past them?
Sent you a PM, I'd appreciate some help and I'll give you something in return

 

[yumxuidu]

Does anybody know how he managed to get the files from Tribot.org? The site does have a few vulnerabilities, so I'm guessing OP managed to get past them?
Sent you a PM, I'd appreciate some help and I'll give you something in return

Replied in PM, but will re-iterate here for anyone interested.

No kind of exploits or anything of the sort were required (not even deobfuscation of the Tribot client).

Instead, I simply made the Tribot client connect to a server I ran instead of tribot.com and replayed requests and responses to see what Tribot expected and would send, etc. The end result (the scripts) is highly simplified and nothing at all like what is on the official servers.

 

[flopynoky]

Nahhh

 

[Phantom866]

The client can detect if you edit the hosts file to redirect it away from tribot servers. It won't let you run the client.

 

[mercatres]

This works.
Been using it for a while.

 

[yumxuidu]

The client can detect if you edit the hosts file to redirect it away from tribot servers. It won't let you run the client.

It can, but the version of the client I was using didn't do anything of the sort.

Looks like it's been changed (which is kind of fucking hilarious -- fixing the bot so you can auto properly is too hard, but stopping someone getting free VIP is top priority).

In any case, Trilez isn't known for his skills when it comes to Java. I'll have a play around and see how he does the check. Wouldn't be surprised if there was an easy way around it.

 

[yumxuidu]

As suspected, Trilez is in a class of his own once again.

The check for "tribot.org" in the hosts file is case sensitive.
I'll update the install instructions, but for anyone who wants to use it, just change the line in hosts to 213.123.123.12.3..1.3 Tribot.org or similar.

For what it's worth, I don't expect this to last. Even Trilez can't be stupid enough to think that this is actually going to stop anything (even if he did make the check case sensitive), so I'll think about how best to avoid these kinds of issues properly a little more.

Welcoming ideas, if anyone has them! Feel free to send a pull request for anything else people would like changed, too.

 

[Whereswaldo]

Ha this was an interesting read.

 

[yumxuidu]

Since I've seen a few people using this, I've updated it to work with the newest Tribot update.

https://github.com/ss23/tribot-authentication/wiki/Install-For-Users

Basically, Trilez is now doing a case sensitive check in the hosts file for "tribot.org" or something, so we just use an alternative way to hijack DNS.
In this case, using Acrylic DNS Proxy. Wiki has a video to help explain it if anyone wants to use it.

 

[jknox]

Nice work. Sure beats deobbing the client like some people have L.

If you wanted to, what malicious things could you do to someone connecting to your auth server :?

 

[Melvin]

Why do you have to be such a dick? Tribot is the only bot on the market worth paying for and its well worth it

 

[yumxuidu]

Nice work. Sure beats deobbing the client like some people have L.

If you wanted to, what malicious things could you do to someone connecting to your auth server :?

Well, intentionally, it won't accept any sessions that you've used before - that's why you always have to enter a username and password explicitly rather than just click accept. The idea behind that is to enforce people generating a new session each time, rather than giving the official server more of an opportunity to steal session IDs. The IDs themselves likely wouldn't do much though, certainly not change passwords.
Of course, the more obvious thing is that some people will enter legitimate usernames and passwords, which I could collect. However, I explicitly advise against this, so I'd hope no one was doing it. Additionally, the code on github, which is exactly the same as I run on tribot.ss23.geek.nz, has no mechanism for logging passwords and usernames as it is.

However, if you were wondering about worst case, it's simple. The client checks for updates every time it logs in, and Trilez in his infinite wisdom decided that any kind of code signing mechanisms weren't needed (or at the very least, too hard for someone of his abilities). So, if anyone pointed their client to my server, worst case is I replace Tribot with a version that looks the same but is actually a trojan/virus or whatever. Basically, I could execute any code on your PC that I wanted. A less malicious variation would be just a modified Tribot client which would steal your credentials.

Of course, this should all scare you. By using my server, you're putting yourself in a position where I could do this, which is something I would never recommend to anyone (though truthfully, I would be more worried about the quality of code produced by scripters and Trilez himself having bugs that get you hacked much more than I would be worried about a crack server causing you harm). So, my advise is to not use it and set it up yourself. However, I haven't put the instructions up for running it yourself, so it might be difficult for people (in fact, I was informed by some staff at Tribot that my crack "didn't work", when they actually just didn't understand SSL enough to set the server up properly, which was kind of an amazingly funny situation).

All this being said, I don't play Runescape or have any intentions of stealing credentials (being that needlessly mean isn't my style), so I don't think it's anything worth being worried about too much, though of course if you do get hacked for using this, I'll laugh at you because it's your own fault.

 

[yumxuidu]

Why do you have to be such a dick? Tribot is the only bot on the market worth paying for and its well worth it

A bit of a loaded question, but I'll try explain some things.

I don't believe in paying in software (generally). That is, while I acknowledge it's one way of creating software, I don't think that it's always the best way. I'm sure you're all familiar with things like Linux which aren't sold, yet are still decent (and actually contributed to by major corporations). So in regards to Tribot being "worth" paying for, I think not. Specifically, I think Tribot would be much better if it was opensource.
If you're interested in learning more about opensource and Free Software, there are plenty of resources online describing the ideas behind it and how it can work, etc. Keep in mind though, on both sides of the table, there's a lot of bias and most of the content is propaganda. Try approach it with an analytical mind and you might be interested in the results.

I have other reasons for doing this though, of course. A friend asked me to do this for him, and I have a personal interest in helping out my friends if I can, but no personal interest in helping Trilez get an extra $5 (especially when it's so easy to dehumanize Trilez by making fun of his idiotic code).
For me, it's fun to do this kind of thing. There's fun to be had in a more academic application of these kinds of skills (though really, this kind of thing doesn't take 'skill', it takes understanding the HTTP protocol and that's about it), I find working with real software more fun. It gets even *more* fun when I get to watch an incompetent programmer try to implement features to prevent the crack.
In addition, I love the kind of irony that exists here. Tribot exists to automate the playing of Runescape. That is, to save you time, so you don't have to play it yourself, but you get the rewards (some of them, at least). Jagex is on a constant battle with botters to try shut them down, and bots come back each time. I enjoy watching the same kind of thing happen here, but in place of Jagex we have the makers of bots like Tribot battling with me writing cracks. It's almost like a delightful poetic justice.

However, keep in mind while I have strong ideals about software, the primary reason I do this *is* for fun. I have no vested interest in keeping this crack running. I don't use Tribot, I don't even have a Runescape account, nor do I have any intentions of playing it or botting or anything of the sort.
When it stops being fun (and it seems like with all the vain attempts at shutting down this crack so far, it's only going to get more fun), I'll stop doing it.

tldr; because it's fun.